Alert queue

In short

The Alerts screen is the work queue for everything your rules have raised. Open alerts are listed riskiest first, so the top of the list is always the next thing to look at. Tabs let you switch to alerts already in a case, closed alerts, or all of them, and a filter narrows the list by severity. On the Open tab you can also tick several alerts and close them together, with one outcome and one reason.

Who can see it: anyone with alerts.view (by default every role except Administrator). See Who can do what.

How to open the alert queue

1. Select Alerts in the menu. The number beside it is how many alerts are open.
2. The Open tab is selected. Work from the top of the list down.
3. Select any row to review the alert.

The tabs

Tab	Shows	Order
Open	Alerts waiting for someone to dismiss them or open a case. This is your work queue	Highest risk first: critical, then high, medium and low; within a severity, the highest score first; then the most recent activity
In a case	Alerts that are part of an open or closed investigation	Newest first, by latest activity
Closed	Alerts that were dismissed, or closed together with their case	Newest first
All	Every alert, whatever its status	Newest first

The line above the page title reminds you of the order: Highest risk first or Newest first.

How to filter by severity

1. Open the drop-down at the top right of the Queue panel. It reads Any severity.
2. Choose Critical, High, Medium or Low.

The filter applies to whichever tab is selected. Choose Any severity to remove it.

Where your workspace uses the AI assistant, the Open tab has a second filter, Any advice, that narrows the queue by what the assistant currently advises, and a bar with Review the queue that asks it about every open alert without advice. See Asking about the whole queue.

How to close several alerts at once

When several open alerts have the same explanation (the same agent’s device, the same payroll run, a rule you know is misfiring this week), you can close them together. It is still your decision about each alert: every alert you close this way is recorded as closed by you, with the outcome and the reason you gave.

You need cases.work. The tick boxes appear only on the Open tab.

1. Open each alert you mean to close and read it. Closing in bulk saves typing, not reading.
2. On the Open tab, tick the box at the left of each alert. To tick everything listed, select Select all N above the list; Clear the selection unticks them.
3. Select Close the selected. A sheet headed Your decision, titled Close N alerts, opens.
4. Under Outcome, choose False positive, No action needed or Duplicate. The meanings are the same as when you dismiss one alert.
5. Under Reason, write what you checked and why these alerts can be closed together. A reason is required here (at least 10 characters, at most 2,000), unlike the optional rationale on a single alert.
6. Select Close N alerts.

If every alert was closed you return to the queue. If some were not, the sheet says so, for example 2 alerts were left open: they were no longer open, or have to be closed on their own page. Select Back to the queue; the alerts left open are still in the list.

What is never closed in bulk

SpeculaPro leaves these open, and you close them one at a time on their own page. The first three kinds are called held alerts (held: true in the API): the server refuses them even if a request names them, answering sanctions alerts and critical alerts are closed one at a time or alerts about politically exposed or sanctioned persons, their relatives and their accounts are closed one at a time.

Left open	How you can tell
A sanctions alert	It has no tick box. Point at the gap to read Sanctions alerts, critical alerts and alerts about politically exposed persons are closed one at a time
A critical alert	It has no tick box
An alert whose subject is designated PEP (pep), relative or close associate of a PEP (pep_rca) or sanctioned (sanctioned), or is an account owned by such a customer	It has no tick box
An alert that someone dismissed or put in a case meanwhile	Counted among the alerts left open

What this check does not cover

• An alert about a subject with a high-risk designation, an adverse-media flag or a high risk rating can be closed in bulk, and so can any high-severity alert.
• For an account, the check looks at the customer recorded as its owner, not at signatories or other people linked to it.
• Select all N ticks every alert in the list that has a tick box, up to the 100 the screen lists, so it leaves the held alerts out. One request closes at most 100 alerts.

Apply your institution’s own rules about which alerts may be closed together.

The assistant’s advice is not a reason

With the AI assistant on, you can filter the queue to AI: likely false positive, select everything that has a tick box and close it with one written reason. Held alerts are left out and a reason is required, but nothing else in SpeculaPro stops that, and nothing in it checks that you opened the alerts. If you do it without reading them, a language model has dismissed your alerts and you have signed each dismissal. The assistant has not seen your notes, your evidence or anyone’s name, and it can be wrong. The assistant said so is not a reason an examiner will accept. The assistant itself never closes anything: only a person’s request does.

What is recorded: for each alert closed, the outcome, your reason, your name and the time, in the permanent audit log as alert.close, with the number of alerts in the same request (bulk). Someone reviewing closures can therefore find every alert that was closed as part of a batch and how large the batch was. All the alerts in one request are closed together or, if the request fails part-way, not at all.

Reading an alert row

Each row is one alert: one subject (usually a customer) and every rule hit about them in this episode of activity.

Part of the row	What it means
Score ring (the circle with a number)	The alert’s risk score, 0 to 100: the highest score of any hit in the alert. The coloured arc fills in proportion to the score and takes the severity’s colour. Hover over it to read Risk score …
Subject	Who the alert is about, with a small label: customer, account or counterparty. If your role can’t view customers you see a code such as Customer 3f9a1c instead of the name
FRAUD (gold)	A fraud alert, raised by a real-time decision rather than by post-event monitoring. AML alerts have no tag. See AML and fraud alerts
Summary	A one-line description of the most recent activity, written by the rule that fired. When there is none, the names of the rules that fired
Severity	Critical, High, Medium or Low: the highest severity among the hits
N rules	Shown when more than one rule fired. Several independent rules agreeing is a stronger signal than one
Hits	How many rule hits the alert holds. Further hits of the same kind on the same subject are added to the same alert instead of creating new ones
Case number (gold, for example SP-2026-000123)	The case this alert belongs to, once it is in one
Outcome	On closed alerts, how they ended: false positive, no action, duplicate, or escalated to case when the alert was closed together with its case
AI: likely false positive, AI: investigate or AI: can’t tell	On open alerts, when your workspace uses the AI assistant: its current advice. It is advice only, changes nothing about the alert, and disappears when the alert gets a hit the assistant hasn’t read
Exposure (right)	The total value of the transactions behind the alert, in your workspace’s base currency
Time (right, with a clock)	How long ago the latest hit arrived: just now, 12m ago, 3h ago, 2d ago

Severity and score help you prioritise; they don’t decide

A low-score alert on a politically exposed person can matter more than a high-score alert on a long-standing business. Always open the alert and read the evidence. See Investigating an alert.

Alerts from confirmed screening matches

When a reviewer confirms a screening match as a true match, SpeculaPro raises an alert for it and puts it straight into a case, so it never waits in Open. Its summary reads Confirmed sanctioned match: … (or pep, and so on) and its rule is shown as screening.match. See Reviewing a potential match.

How many alerts are listed

The Queue panel heading shows how many alerts are listed, for example 37 alerts. The screen lists at most 100 alerts at a time. When it shows 100+ alerts, there are more than the screen can list.

• On the Open tab you always see the 100 riskiest, so the most important work is never hidden. Dismissing or opening cases for alerts at the top brings the next ones into view.
• On the other tabs you see the 100 most recent. Use the severity filter to narrow the list, or ask someone with API access to page through older alerts.

When the queue is empty

• On Open: Queue is clear. No open alerts. New ones arrive here within seconds of the transaction that triggers them.
• On any other tab, or with a filter: Nothing here. No alerts match this filter.

New alerts appear on their own

The list refreshes every 30 seconds. You don’t need to reload the page.

On the Closed tab, each alert shows its outcome, for example false positive. Open it to see who closed it, when, and their rationale.

Related

• Reviewing an alert
• The AI assistant’s advice
• Choosing a disposition
• Alerts and cases: the alert queue
• Investigating an alert
• Command center